systex | 9fab5dc39e00bf46ae311f2815502e9469da5f13428c08780d7d7ec46c59d75c

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260718-d99e7sfs5q
SHA256 9fab5dc39e00bf46ae311f2815502e9469da5f13428c08780d7d7ec46c59d75c
MD5 5c1ee1cbb62a69b7dd024559c8d23ab3
SHA1 e209d73e5339df0f1cde592877de804a4a0de197
SHA512 536992aa9606dbd42cb60491210a972a8e9814538f79fe4edcc943b959f219c4082ffba76ccbce76a633a35881aa748548be295393fcdec7325079fcfda8e0a2
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T175344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5688	CP.exe
2488	lgaytqlbvn.exe
3364	CP.exe
4784	CP.exe
4436	i_lgaytqlbvn.exe
4300	vqnigaysql.sys
5352	CP.exe
4164	lfdxvtnlfd.exe
2224	CP.exe
3024	CP.exe
948	i_lfdxvtnlfd.exe
3420	cayspkicax.sys
3448	CP.exe
2664	faxsqkicau.exe
4132	CP.exe
2756	CP.exe
1836	i_faxsqkicau.exe
2364	hfcxvpnhfz.sys
4548	CP.exe
2780	caxspkhcau.exe
2420	CP.exe
3212	CP.exe
5008	i_caxspkhcau.exe
4600	hfcauspjhf.sys
1472	CP.exe
3520	hczusmkecx.exe
5228	CP.exe
4500	CP.exe
3624	i_hczusmkecx.exe
3344	cwuomhezwu.sys
4424	CP.exe
1100	zxrpkezwrp.exe
4488	CP.exe
4772	CP.exe
5308	i_zxrpkezwrp.exe
5048	ecwtjebwur.sys
3372	CP.exe
3400	wtrojgebwt.exe
4752	CP.exe
5916	CP.exe
5704	i_wtrojgebwt.exe
940	jdbztrljeb.sys
3164	CP.exe
3004	eywrojytrl.exe
4368	CP.exe
4440	CP.exe
2336	i_eywrojytrl.exe
560	tqljdbytqo.sys
2600	CP.exe
6124	oigbytrljd.exe
6068	CP.exe
5596	CP.exe
2440	i_oigbytrljd.exe
4124	lidbvtnlfd.sys
5400	CP.exe
3752	davtnlfdyv.exe
4600	CP.exe
3860	CP.exe
2188	i_davtnlfdyv.exe
5216	davtndxvpn.sys
2888	CP.exe
6128	sqkicausnk.exe
4936	CP.exe
5760	CP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4108_1878438375\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4108_1525912775\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4108_1525912775\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgaytqlbvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eztrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkiusnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkiusnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgaytqlbvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrojgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrojgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwupmhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwupmhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eztrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6012	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2016	ipconfig.exe
5976	ipconfig.exe
2352	ipconfig.exe
2960	ipconfig.exe
2364	ipconfig.exe
5420	ipconfig.exe
4552	ipconfig.exe
5780	ipconfig.exe
5692	ipconfig.exe
4100	ipconfig.exe
4264	ipconfig.exe
5528	ipconfig.exe
2400	ipconfig.exe
5864	ipconfig.exe
2248	ipconfig.exe
2364	ipconfig.exe
5872	ipconfig.exe
6092	ipconfig.exe
5440	ipconfig.exe
6080	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288198286168753"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{F60F3075-62BF-4CAD-A03B-27E4FD8D2DAC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
2488	lgaytqlbvn.exe
2488	lgaytqlbvn.exe
2488	lgaytqlbvn.exe
2488	lgaytqlbvn.exe
2488	lgaytqlbvn.exe
2488	lgaytqlbvn.exe
2488	lgaytqlbvn.exe
2488	lgaytqlbvn.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	i_lgaytqlbvn.exe
Token: SeDebugPrivilege	948	i_lfdxvtnlfd.exe
Token: SeDebugPrivilege	1836	i_faxsqkicau.exe
Token: SeDebugPrivilege	5008	i_caxspkhcau.exe
Token: SeDebugPrivilege	3624	i_hczusmkecx.exe
Token: SeDebugPrivilege	5308	i_zxrpkezwrp.exe
Token: SeDebugPrivilege	5704	i_wtrojgebwt.exe
Token: SeDebugPrivilege	2336	i_eywrojytrl.exe
Token: SeDebugPrivilege	2440	i_oigbytrljd.exe
Token: SeDebugPrivilege	2188	i_davtnlfdyv.exe
Token: SeDebugPrivilege	1600	i_sqkicausnk.exe
Token: SeDebugPrivilege	5824	i_xsqkiusnkf.exe
Token: SeDebugPrivilege	2352	i_pkhfzxrpkh.exe
Token: SeDebugPrivilege	2336	i_zwupmhecwu.exe
Token: SeDebugPrivilege	5556	i_eztrojhbzt.exe
Token: SeDebugPrivilege	4532	i_ljhbztrlje.exe
Token: SeDebugPrivilege	2336	i_wqolgeywqo.exe
Token: SeDebugPrivilege	5476	i_lidavtnlfd.exe
Token: SeDebugPrivilege	5012	i_fdxvqnifay.exe
Token: SeDebugPrivilege	1012	i_faxsqkicav.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 1152	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 4920 wrote to memory of 2608	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 2608 wrote to memory of 1044	2608	iexplore.exe	90
PID 1152 wrote to memory of 4108	1152	iexplore.exe	91
PID 4108 wrote to memory of 3256	4108	msedge.exe	92
PID 4108 wrote to memory of 616	4108	msedge.exe	93
PID 4108 wrote to memory of 6012	4108	msedge.exe	94
PID 4108 wrote to memory of 616	4108	msedge.exe	93
PID 4108 wrote to memory of 616	4108	msedge.exe	93
PID 4108 wrote to memory of 5740	4108	msedge.exe	95
PID 4108 wrote to memory of 5740	4108	msedge.exe	95
PID 4108 wrote to memory of 4640	4108	msedge.exe	97
PID 4108 wrote to memory of 4640	4108	msedge.exe	97
PID 4108 wrote to memory of 4640	4108	msedge.exe	97
PID 4108 wrote to memory of 5172	4108	msedge.exe	98
PID 4108 wrote to memory of 5172	4108	msedge.exe	98
PID 4108 wrote to memory of 5172	4108	msedge.exe	98
PID 4108 wrote to memory of 2684	4108	msedge.exe	100
PID 4108 wrote to memory of 3488	4108	msedge.exe	99
PID 4108 wrote to memory of 2684	4108	msedge.exe	100
PID 4108 wrote to memory of 2684	4108	msedge.exe	100
PID 4108 wrote to memory of 3488	4108	msedge.exe	99
PID 4108 wrote to memory of 3488	4108	msedge.exe	99
PID 4108 wrote to memory of 2568	4108	msedge.exe	101
PID 4108 wrote to memory of 2568	4108	msedge.exe	101
PID 4108 wrote to memory of 2568	4108	msedge.exe	101
PID 4920 wrote to memory of 5688	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 2488 wrote to memory of 3364	2488	lgaytqlbvn.exe	106
PID 4108 wrote to memory of 3260	4108	msedge.exe	109
PID 4108 wrote to memory of 1156	4108	msedge.exe	110
PID 4108 wrote to memory of 3260	4108	msedge.exe	109
PID 4108 wrote to memory of 1156	4108	msedge.exe	110
PID 4108 wrote to memory of 2928	4108	msedge.exe	112
PID 4108 wrote to memory of 2616	4108	msedge.exe	113
PID 4108 wrote to memory of 2616	4108	msedge.exe	113
PID 4108 wrote to memory of 2852	4108	msedge.exe	115
PID 4108 wrote to memory of 2852	4108	msedge.exe	115
PID 4108 wrote to memory of 1132	4108	msedge.exe	116
PID 4108 wrote to memory of 1132	4108	msedge.exe	116
PID 4920 wrote to memory of 4784	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4920 wrote to memory of 5352	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 4164 wrote to memory of 2224	4164	lfdxvtnlfd.exe	125
PID 4920 wrote to memory of 3024	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4920 wrote to memory of 3448	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 2664 wrote to memory of 4132	2664	faxsqkicau.exe	134
PID 4920 wrote to memory of 2756	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4920 wrote to memory of 4548	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 2780 wrote to memory of 2420	2780	caxspkhcau.exe	143
PID 4920 wrote to memory of 3212	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4108 wrote to memory of 2052	4108	msedge.exe	149
PID 4108 wrote to memory of 1048	4108	msedge.exe	150
PID 4108 wrote to memory of 6044	4108	msedge.exe	151
PID 4920 wrote to memory of 1472	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 3520 wrote to memory of 5228	3520	hczusmkecx.exe	156
PID 4920 wrote to memory of 4500	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4920 wrote to memory of 4424	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 1100 wrote to memory of 4488	1100	zxrpkezwrp.exe	165
PID 4920 wrote to memory of 4772	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4920 wrote to memory of 3372	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 3400 wrote to memory of 4752	3400	wtrojgebwt.exe	174
PID 4920 wrote to memory of 5916	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4920 wrote to memory of 3164	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 3004 wrote to memory of 4368	3004	eywrojytrl.exe	183
PID 4920 wrote to memory of 4440	4920	2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5c1ee1cbb62a69b7dd024559c8d23ab3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffde6a9c188,0x7ffde6a9c194,0x7ffde6a9c1a0
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,798738781595265455,6360554271371597159,262144 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,2777792362320872453,16481319639032054649,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,12657452335298982106,471840288258033410,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,15637485594240429092,10951574919815540581,2097152 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,3502410289385554592,1552089215837251997,2097152 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,15356358865743893882,15333810287766045508,2097152 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,4121565729439580841,1223352109232292859,2097152 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4500,i,8706092829141550781,13244822969420639709,2097152 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,8997307782431364131,7557126218063679206,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11166527959626352286,13094066697802584291,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5286391708164699086,14888151253062932054,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5286391708164699086,14888151253062932054,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,6075859684247351118,12964675338401067472,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,12624995783623205523,17665958900283674166,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,18232241555635631354,16435158943713367339,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,12858641965273875844,12145788441045376337,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,3045340566671512084,5609337396611054294,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,17089084144195143995,13333097883706979064,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,17225532681032679858,12398173055140481412,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,2457858036530594386,16329274502294494595,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6748,i,10824340585806809325,17758705039199303221,262144 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:10
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,12296544437421577062,10159722949384078075,524288 --field-trial-handle=2316,i,2970108221863942871,2975713803606879562,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:2688
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgaytqlbvn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5688
- - C:\Temp\lgaytqlbvn.exe
    C:\Temp\lgaytqlbvn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgaytqlbvn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4784
- - C:\Temp\i_lgaytqlbvn.exe
    C:\Temp\i_lgaytqlbvn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5352
- - C:\Temp\lfdxvtnlfd.exe
    C:\Temp\lfdxvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3024
- - C:\Temp\i_lfdxvtnlfd.exe
    C:\Temp\i_lfdxvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3448
- - C:\Temp\faxsqkicau.exe
    C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2756
- - C:\Temp\i_faxsqkicau.exe
    C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxspkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4548
- - C:\Temp\caxspkhcau.exe
    C:\Temp\caxspkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxspkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3212
- - C:\Temp\i_caxspkhcau.exe
    C:\Temp\i_caxspkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1472
- - C:\Temp\hczusmkecx.exe
    C:\Temp\hczusmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4500
- - C:\Temp\i_hczusmkecx.exe
    C:\Temp\i_hczusmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4424
- - C:\Temp\zxrpkezwrp.exe
    C:\Temp\zxrpkezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4772
- - C:\Temp\i_zxrpkezwrp.exe
    C:\Temp\i_zxrpkezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrojgebwt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Temp\wtrojgebwt.exe
    C:\Temp\wtrojgebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrojgebwt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5916
- - C:\Temp\i_wtrojgebwt.exe
    C:\Temp\i_wtrojgebwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywrojytrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3164
- - C:\Temp\eywrojytrl.exe
    C:\Temp\eywrojytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywrojytrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4440
- - C:\Temp\i_eywrojytrl.exe
    C:\Temp\i_eywrojytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Temp\oigbytrljd.exe
    C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5596
- - C:\Temp\i_oigbytrljd.exe
    C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5400
- - C:\Temp\davtnlfdyv.exe
    C:\Temp\davtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3860
- - C:\Temp\i_davtnlfdyv.exe
    C:\Temp\i_davtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2888
- - C:\Temp\sqkicausnk.exe
    C:\Temp\sqkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5760
- - C:\Temp\i_sqkicausnk.exe
    C:\Temp\i_sqkicausnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkiusnkf.exe ups_run
  2⤵
  PID:2056
- - C:\Temp\xsqkiusnkf.exe
    C:\Temp\xsqkiusnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkiusnkf.exe ups_ins
  2⤵
  PID:4688
- - C:\Temp\i_xsqkiusnkf.exe
    C:\Temp\i_xsqkiusnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhfzxrpkh.exe ups_run
  2⤵
  PID:5008
- - C:\Temp\pkhfzxrpkh.exe
    C:\Temp\pkhfzxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhfzxrpkh.exe ups_ins
  2⤵
  PID:4956
- - C:\Temp\i_pkhfzxrpkh.exe
    C:\Temp\i_pkhfzxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwupmhecwu.exe ups_run
  2⤵
  PID:4304
- - C:\Temp\zwupmhecwu.exe
    C:\Temp\zwupmhecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwupmhecwu.exe ups_ins
  2⤵
  PID:5896
- - C:\Temp\i_zwupmhecwu.exe
    C:\Temp\i_zwupmhecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eztrojhbzt.exe ups_run
  2⤵
  PID:1196
- - C:\Temp\eztrojhbzt.exe
    C:\Temp\eztrojhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eztrojhbzt.exe ups_ins
  2⤵
  PID:3556
- - C:\Temp\i_eztrojhbzt.exe
    C:\Temp\i_eztrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljhbztrlje.exe ups_run
  2⤵
  PID:2708
- - C:\Temp\ljhbztrlje.exe
    C:\Temp\ljhbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljhbztrlje.exe ups_ins
  2⤵
  PID:2704
- - C:\Temp\i_ljhbztrlje.exe
    C:\Temp\i_ljhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqolgeywqo.exe ups_run
  2⤵
  PID:6092
- - C:\Temp\wqolgeywqo.exe
    C:\Temp\wqolgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqolgeywqo.exe ups_ins
  2⤵
  PID:3624
- - C:\Temp\i_wqolgeywqo.exe
    C:\Temp\i_wqolgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidavtnlfd.exe ups_run
  2⤵
  PID:3780
- - C:\Temp\lidavtnlfd.exe
    C:\Temp\lidavtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidavtnlfd.exe ups_ins
  2⤵
  PID:3452
- - C:\Temp\i_lidavtnlfd.exe
    C:\Temp\i_lidavtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnifay.exe ups_run
  2⤵
  PID:4964
- - C:\Temp\fdxvqnifay.exe
    C:\Temp\fdxvqnifay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnifay.exe ups_ins
  2⤵
  PID:4532
- - C:\Temp\i_fdxvqnifay.exe
    C:\Temp\i_fdxvqnifay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicav.exe ups_run
  2⤵
  PID:1332
- - C:\Temp\faxsqkicav.exe
    C:\Temp\faxsqkicav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicav.exe ups_ins
  2⤵
  PID:3660
- - C:\Temp\i_faxsqkicav.exe
    C:\Temp\i_faxsqkicav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3344

C:\Temp\vqnigaysql.sys
C:\Temp\vqnigaysql.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\cayspkicax.sys
C:\Temp\cayspkicax.sys
1⤵
- Executes dropped EXE
PID:3420

C:\Temp\hfcxvpnhfz.sys
C:\Temp\hfcxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:2364

C:\Temp\hfcauspjhf.sys
C:\Temp\hfcauspjhf.sys
1⤵
- Executes dropped EXE
PID:4600

C:\Temp\cwuomhezwu.sys
C:\Temp\cwuomhezwu.sys
1⤵
- Executes dropped EXE
PID:3344

C:\Temp\ecwtjebwur.sys
C:\Temp\ecwtjebwur.sys
1⤵
- Executes dropped EXE
PID:5048

C:\Temp\jdbztrljeb.sys
C:\Temp\jdbztrljeb.sys
1⤵
- Executes dropped EXE
PID:940

C:\Temp\tqljdbytqo.sys
C:\Temp\tqljdbytqo.sys
1⤵
- Executes dropped EXE
PID:560

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:4124

C:\Temp\davtndxvpn.sys
C:\Temp\davtndxvpn.sys
1⤵
- Executes dropped EXE
PID:5216

C:\Temp\usnkicausn.sys
C:\Temp\usnkicausn.sys
1⤵
PID:5036

C:\Temp\pnhfzxrpnh.sys
C:\Temp\pnhfzxrpnh.sys
1⤵
PID:1520

C:\Temp\zxrpmhecwu.sys
C:\Temp\zxrpmhecwu.sys
1⤵
PID:5004

C:\Temp\jhbztrmjwu.sys
C:\Temp\jhbztrmjwu.sys
1⤵
PID:4632

C:\Temp\ljhbzwuomg.sys
C:\Temp\ljhbzwuomg.sys
1⤵
PID:3084

C:\Temp\eywqoigbyw.sys
C:\Temp\eywqoigbyw.sys
1⤵
PID:4384

C:\Temp\qligaysqnl.sys
C:\Temp\qligaysqnl.sys
1⤵
PID:1700

C:\Temp\sqlidbvtnl.sys
C:\Temp\sqlidbvtnl.sys
1⤵
PID:2304

C:\Temp\fausqnifdx.sys
C:\Temp\fausqnifdx.sys
1⤵
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caxspkhcau.exe

Path C:\Temp\caxspkhcau.exe
Size 230KB
SHA256 767b98b0458fbb32411d92fdab1e4f4560b25af8b9284c46126de49e03656111
MD5 91199d26e2ff681274673baade19ea32
SHA1 657563d0f39613beca671f97a150a9cbc0346c2d
SHA512 07a5990cb61c6a062e607d51518c8c960e0b3a663ac35cc91df08f4d8527816829600ca0546cb07a820aac1ade937ffe9c86950ed10f8dbf43126d18ce0d0c9a
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cayspkicax.sys

Path C:\Temp\cayspkicax.sys
Size 141KB
SHA256 5efc64ead924ee92af17030818718cf49be632c70759f4bec23542f4a0638e7b
MD5 21d3300c8f71e59bd57a3bfee2cad3b1
SHA1 5d85e18b521563ba3e89826dbb20344265ba2a02
SHA512 ef9577f96621c176458a190cefb25f52a0d4fd39c3760293ee46c198b515aa60bb14e098c386af04410adcd9d61fd30343467af51cff0d9cd85b0554fd84e189
SSDEEP 3072:HsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:HsQmpcF8BzXfwV
TLSH
T15AE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomhezwu.sys

Path C:\Temp\cwuomhezwu.sys
Size 141KB
SHA256 c6e223c593ebfe18943c176640fbd11cfeee2af0c77a751f6f1ca5eb2d8dc625
MD5 566977add03510e01e1de820c10fce6b
SHA1 95c9122ad0fd53ee1519db41be83e86ecb378047
SHA512 0861a1fa408626c2a8eedf3155bd161fbaad0ab70a088313d0242c4f218c2be928354bcb51e7a434efaa9cc0fdd095fdad8e5bdbd781cbbec527fe48b29b2932
SSDEEP 3072:usQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:usQmpcF8BzXfwV
TLSH
T192E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicau.exe

Path C:\Temp\faxsqkicau.exe
Size 230KB
SHA256 f54d4ab9b320c83e204fc7e4ad1e5669ef3938dc2bffbd1983b3811195ac4b9e
MD5 d11b6864a10a9ebade6156402c18d02e
SHA1 e610ef912e0a39134303a3f6a424d1c0b5a8367c
SHA512 977480b127be8a44d4b259074d41bea8aefe8848fd10e82a84ceafd74aa913a083b25782adbe0492cf978425cec80e357b0553c4ef46c3b70e1a4b42f548569d
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T104344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecx.exe

Path C:\Temp\hczusmkecx.exe
Size 230KB
SHA256 f69055032a3389a61275b39c4c7ef938b5d2d63c0aac9ff920060382394e0164
MD5 18ca8e71aabfd0110ae2edd7e1c540cc
SHA1 81a760b53c6e366c38c1c9e6d1166a64376b373f
SHA512 1c82e495b6b52a1053fff6d5a2073464fb902649743166b316db21287750dbde8a99034e87a09f93918ff494932aa1948888d745a7f2a116d0e2fd0987ca7825
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcauspjhf.sys

Path C:\Temp\hfcauspjhf.sys
Size 141KB
SHA256 344000185d292641f2accb1dec1d4b97e687289e8d0f06928f0c2a22cfb3c950
MD5 7406dcc04e47b6c99bb9dc137d469e4a
SHA1 e048441259b69a14946ca098388e6d5404e50629
SHA512 fe19f6d9d3b416cd2c045e9c5b35bad5078ef90bafcf90ebd6f67a629625d278855bdd0c1f33ff847f06d4132f940d9a05b79e5927371d9ea56edf85e278976c
SSDEEP 3072:VsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:VsQmpcF8BzXfwV
TLSH
T107E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcxvpnhfz.sys

Path C:\Temp\hfcxvpnhfz.sys
Size 141KB
SHA256 68b523b0e71a7d57e518b9106e1ab4fc0e0ba1d39091c999ae0de03162d51aa1
MD5 a2af726c3cdf5bd6cda0646814874bef
SHA1 134b268dcff1b904ac28ec00832ef3936c16103e
SHA512 3044c2f74f4b261ac7757233293762e45bf598d094be1251590d52372d3eec260bbae2398ed26bf1e3ebe30e639574eaddb0d56e94fe274d5ccfc2bb31c4e75e
SSDEEP 3072:dsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:dsQmpcF8BzXfwV
TLSH
T1FCE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caxspkhcau.exe

Path C:\Temp\i_caxspkhcau.exe
Size 230KB
SHA256 16ac2c60dbaee3f0115e7b06dbc01d5fd69a0d063229b05fa61f2454bfc2c5fa
MD5 ff68793e3a09705f252100c5ee4e130d
SHA1 b7bb04907f84a7c526bd548086a18748cfd0a01a
SHA512 9f558ab5d52f439852364dc428502fea3aa15f443884dd848c838b384a8540bae4b5071933f1bdcc17fba73ea5f528e5fdaea912e865838b3a3004b0cc5c4ea0
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T149344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxsqkicau.exe

Path C:\Temp\i_faxsqkicau.exe
Size 230KB
SHA256 3bd53ba458da097307f5a70864ad4dc9631894efa904245cef110e653acfbf1e
MD5 3140bde2a39b66c52094d54225c7250d
SHA1 6c81e837914f153454e5def3dbea9ac1fea7bf1b
SHA512 acea7117ef2433f23f58646d4e45b12a5ae6651fb681d2e6f310935c6acf24b74531f2b6010021f505faaebbc8dbf86e09c457f518d4c04523acf4bf0f0c835a
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:JghLQ0sQmpcF8BzXfwVfAI
TLSH
T1CE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczusmkecx.exe

Path C:\Temp\i_hczusmkecx.exe
Size 230KB
SHA256 eae0cbbe4f7d6bd86c34445ae4288a28b9a18d18148f1706a3332b48c6fa0f02
MD5 25f1fd3481840f81ae402e5931e25c64
SHA1 9fcf4d4f555ef4728378ebe823cf2ab9f649dea8
SHA512 bf0dd1e3f9e6bc2080e065ad12affccbaba18a662031acbca858ef8db960ae33223710a8f929b747d9ba6a0d8496e94f415f2504831a8363f02c94cf01e60639
SSDEEP 3072:oyJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9k:oyghLQ0sQmpcF8BzXfwVfAIu
TLSH
T111344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvtnlfd.exe

Path C:\Temp\i_lfdxvtnlfd.exe
Size 230KB
SHA256 0fc7e037bbcec53a5282252e7229ed801a2b18f1ac637060674bf4d1757d4910
MD5 7a4e6864a2ae7e3ee72f61e69917cc63
SHA1 116ed70ce124689bf99a4d63e117b0a5655d4fb4
SHA512 091b83365822d16b0bbde5d37a9d49f68dbdfbb1c198939d6e00e4ca4661e381d6ceb4fbecc125dc8c53b2d0bfbb577f097ebc6644bf10c920bf8566bd4f2b48
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T131344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgaytqlbvn.exe

Path C:\Temp\i_lgaytqlbvn.exe
Size 230KB
SHA256 4b2ea09d3e8f1ed07b8ab5b59cac5613a48692feeec58f7fd96e02a5ccb72e92
MD5 2d224e53770e79f8ad3d5b767199a074
SHA1 87fff18075e0be559acdeaf96b6f048bf5f9b493
SHA512 34bd0c2b85de2cdc41eb4190586ac41c168a4ba12357b2190519add7ad7a010e08cb08fab39c58f59101092524f6adbb3d23915ebdf9c244f1c54961e5fdb21d
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B4344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpkezwrp.exe

Path C:\Temp\i_zxrpkezwrp.exe
Size 230KB
SHA256 093b4872c56caf024d3fd32c762d48342971cafc57b30a0259a56ac0dbbd706e
MD5 bfa9f19b07f824c0605ec94d9985bccb
SHA1 943a918afe00f6f4da80cce16f3410c72263153a
SHA512 f61107b9e73236205dd00212224747b6ab361963cb91c774be89378bd051ef19ddb90d2b5a4c43c10e9fef16ee77ecfdb2c18236f2b26fd41700a37108c3733b
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T156344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvtnlfd.exe

Path C:\Temp\lfdxvtnlfd.exe
Size 230KB
SHA256 bf11aac2a345fee6bfd5e1857c5a264db27b0cdc8a894b049179942ea8be8889
MD5 045ddfc7b2f5ac24a98b9bc4f2740830
SHA1 5320175f4ebda512e02a0c39daecab015ff1cb4f
SHA512 131c3ea0ac2b695727fad038c754dee40a675acc8bc26f21f012f27c364b659f9f6a28044a08e1f86cc16506058018c58f66077aa20bc91ecc9592ed5175bbfc
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T192344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgaytqlbvn.exe

Path C:\Temp\lgaytqlbvn.exe
Size 230KB
SHA256 dff6755915f6fca079334534387258b9317c1a293e7c4f34af46e46d9c876f31
MD5 89aa1d532ac7c5be4cdb5ca420241388
SHA1 394606a9f1bf0979219df90ca9df8f87ae19e8ed
SHA512 8457e2ffbc73589258db58ae7b6e5816ed341b324c60d6dda80126752a6ece7be8f7cbeb07f0f949e28f7bcd29da0cbeac1e677ea576ed6a904f84bb91906603
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T12F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnigaysql.sys

Path C:\Temp\vqnigaysql.sys
Size 141KB
SHA256 3475aac3bb5c559feea789cefa741c91395bf25d8949e8be8834f3888a8f4ace
MD5 b934987ccd4c5a4a1119f924817f194f
SHA1 2f523a98f6d6910736a357ad7a1b5e4f8c5a5a3d
SHA512 f43d8b4128bdb76f450d4b2d7bc59d0609e4c91bad03e858b9cab60d5dedddfccdf556dccf0fa4ad6b71ace291183e550964bdbee344bc6a6b8d811783ad11af
SSDEEP 3072:IsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:IsQmpcF8BzXfwV
TLSH
T156E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkezwrp.exe

Path C:\Temp\zxrpkezwrp.exe
Size 230KB
SHA256 66ad4d16216277451982b7b2f1ed81eab0ed689ca7189f38d72951c8e363805d
MD5 02f21b5234980ef583df083203fa50dc
SHA1 9a95749e43f1a90f7b17213c3dccab8097f78b44
SHA512 12dc2d3c6c3ae644aa76176250cb255c8f02a9fa37d74b69fc3bf98d2442abf0b198f2e812fc7c226c1ddaedd22a025c366baf74f783a73bf19df5dc066df52f
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:9ghLQ0sQmpcF8BzXfwVfAI
TLSH
T10E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 dd04753f56ec11269127542d7ce5da38c4b521b8cca6a8db5b67648bd8f780d7
MD5 2cfc16340cbe2a7649096f7041451122
SHA1 1539f449a552dde463fe256f877d8804c9b7569b
SHA512 362831b4ba96a6f59f450fd1fa310c35cfe835b6300776d13430415f444a1fce97d7459a6bc340270807b9499e6b5c8af5fa11619573ced64cf4534157b862db
TLSH
T14141C80CC36F18DCC725847EB3E98569363A92F8C183FEBCA0A069756807764E1F08B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e44b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e44b.TMP
Size 2KB
SHA256 12e2dd271263bef6975dbf736d7ef0cf564b362bbeba6cb85ee4ca673e2927ff
MD5 6dbc720e825ac48c6842d2d22245274a
SHA1 e8feae19fd814b8c3bb0ab42e5bc97ec9a3ff5c0
SHA512 e95ef631b1869880c202d5b7d36d8d8d7628739c8849e33614606426ab761153764517bb23db5824f2a3affff60f7da056f2f7d06023b4f4f5410163ce7de75e
TLSH
T1FD41B90CC36F18DCC725847EB3E98569363A92F8C183FEB8A0A069756807760E1F14B1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c3e2847b5ea19905dcf360599f460e0f039428a4560e0b987b3200bf06caac5c
MD5 22c45be6ceb3e63a42160c5574cc708a
SHA1 c0e1d5bbbf18bc39a48efd794aeee9ce3c6d67fb
SHA512 c55279abfca954bea9d3fbbc92a3f4426dd35615317cc4548575d37df5d49737121beb9ede408dbc26d4c3bc4407f346b4e8e0790f815722b154859b72a2d335
TLSH
T19A519CF3C7E8862E890156F0AB147E2BDE1D0A14432C3D5AC9E4EF5BA7E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a83e3f2143187c5f4e063336d23e727529ef5d3a3855d8bc6c8e9ea8c07e7ba9
MD5 e47a763d01aec225f3992823eecf95e6
SHA1 f857466d339d0058458895e90ef9ad8fb2376b66
SHA512 828252086744a4c5b6f41512485e506783d0661c3a8ef72bf7446a979065169c25061ebf8e8f19cb2652eaa935b420d6b975c3f3d55c79d201e5a12f8debc4f7
SSDEEP 192:sxR9RbCH/fZsrBrZ6dzoD8p9k/g6+WNCsUfYCuuO4GJIgtJ:sxR9kH/fZsrBF65q/5WfQB3
TLSH
T19632B7166E28993B9CC7D21DBF25BF53D6F95032A2D41E48ABFC961C00EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2ba781f8db8c759206e7150de3356d2e35435dbea94ab924e316a54e7b5adc4e
MD5 45d50dbd6c47ea1c39875aa15f0aceb6
SHA1 6f119f0b040b183347b5609e985f2642c2b47e29
SHA512 b77f3d058e5bde914e9dd5d4aec4fc86f6ed8d4ebad1d24962b43ceba3213c8c483475a69d06217862ac7e0fc769e950eac9f8206beeb7de95ea3f3ffeb7577a
SSDEEP 192:sxR2RbCH/fZsforZ6dzoD8p9k/g6+WNCsUfYCQuO4GJIgDrJ:sxR2kH/fZsfoF65q/5WfKBp
TLSH
T1B042C6166A28993B9CC7D21DBF15BF53D2F95032A2D41E08ABFC8B1C00EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e61df9dff398e8db2d77e98e8f8daafe2571c624361d945a02b6af5e7970c5b0
MD5 42434f5957a84337144513622cdb719e
SHA1 c070b90b322781d7b202c866d7e4b8a4e07f9ffe
SHA512 093f5cca1e6e4aabbb353b6605b19270ed0557a943f9bca4fa332c3f0c28af4b9fb8db7574b3ff3d353850c54c963d72038671b06eb43a12790c2e2bd0699c22
SSDEEP 192:sxR2RbCH/fZsfBrZ6dzoD8p9k/g6+WNCsUfYCuuO4GJIgDpJ:sxR2kH/fZsfBF65q/5WfQBf
TLSH
T18742C6166E28993B9CC7D21DBF55BF53D2F91032A2D41E48ABFC971C00EA6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7362ffcb40571b549d0b2f79715860fd694a30493fd1b41493615a9e05fa2c7d
MD5 67136d3e558122f3d4795f77dc8ebbe4
SHA1 ba414648d25e7cc965c72ea82ec53f9fef7c3114
SHA512 3d49f6d7be14c02f5d1861561a4a566d9443cf335fbacbac68b3e52a12d26b942f8e8d720f835f8672bbe32dbd3bd1bccbe3f3107bc54bc3678ccf90e6b3683d
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9G30QqcVroZri:jC+vf7E7JQWgQ+f4+u1jayG30Vcu0
TLSH
T1B1D2EB7B640DCB7F4F804ADDEC197EDB6DA802CB9698CD4047FA941C02C67EA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8157.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8157.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a3970b0958063ee1d3a04696942273d5fd72d7f23c61397fdfb50ee784fcabd8
MD5 8216db59d868fb352a134993d0b059f8
SHA1 cced41ff6d758eb626942bb3bfbe20d746ee499d
SHA512 ca36ec16763bacad1566c91f56622291dfe0229177681fc77c4acf55d6ddee0c8897176a2b6654c0e0d14b2ac865cc526151f81bc51d78ea9bc284cc492794d8
SSDEEP 768:vrv+4UNbdD3nm2gP2Xp8+p3bd66j+4BRv86aLIW82bwClP:vbsbp3/Z8+p3Z6n4yu0w6
TLSH
T1DE13BF72E8A99D339CFAC604B2467B837FF811A395C10E94E5D96B4E014A19E270FD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1b12f4a79657f4fcea8e42dbc81e986f57c7887e1b98897a2af449b0aca6f00d
MD5 06ff6279a079ae85fb802670c88eedc1
SHA1 ece1c79ce75be0932efbaa96b6ba631a169cf0dc
SHA512 c9e5d980072f833f1898453b8cecf537fe0b1e08b8c0aff913428216129e5a388fac8caeab911b7bf1471438d2e539fe351875a623a24fa5fc2af25ecb083f87
SSDEEP 768:arv+4UNbdD3hm2gP2Xp8+p3bd66j+4BRv86aLIW8M:absbp3pZ8+p3Z6n4yuM
TLSH
T18603BE72E8A9DD339CF6C604B24677837FF811A39AC00E94D9D96B5D058A19E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bf62078c6bfff18e6da0540e53b7408cc6245e053b4295f094829cdc94f9b53b
MD5 c5251b38ab27a9acf1c4405dba190b08
SHA1 f23c204ea702dea3670bc9533eb5d538c91dce08
SHA512 a7924a4ae4f2f9ecf9fc5c39567e3ca101a9bba3f21abd5027da10b40839d3d4486dc6dedd70c01f26f519aedcfab107232eb9b4bd6c4b527c56c3a84d3f9565
SSDEEP 768:Irv+4UNbdD3ScPZNp8+p3bd66j+4BRv86aLIiM2bwCl1:Ibsbp3nL8+p3Z6n4yG0ww
TLSH
T17C03BE33E9A899739CF6C648B24677437FF851A396C10EC4E4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 7816bdf1c3ff4fb3fc97d444caa0fdc04ff66050bf4f24797171150462de7ca7
MD5 d26da4650be6e7625be323d8f13c40a1
SHA1 080e4a43425abe9d217d0acd65c0cd513ecd4186
SHA512 08d0df6e93addc6a2396875c7677655d0ed66c46951fb0cfd57783cca9aa2539dfc76ec297b23780fa9e5d649820194b8425d8a9d4492b8180a3c79148ee7c0e
SSDEEP 768:nj+9F3hm2gP2Xp8+p3bd66j+4BRv86aLIW8b:K9F3pZ8+p3Z6n4yub
TLSH
T1ACE29E71E8AA9D335CE5C748B2063783AFF411A396C41E98D9DD6B1E048729D270B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5fdfce88abbf64e1784076133811be2b8e59dbad99d41a9044f9bc2c22c5a150
MD5 430c0b98eff2bea45316373edf26620c
SHA1 429db734d2e503d8e5a1674af144c0a6918623a2
SHA512 0bf61a2a66c0d0ad8dfe9bc0b9f1b4dc3bc6d019348450ae7270831a38ec87f77e84af2f40224b1d8d9845d02777468fe41b8e3e542bd6d2b7d05b37dab67248
SSDEEP 768:zrv+4UNbdD3ntP2Np8+p3bd66j+4BRv86aLIW82bwClW:zbsbp3sL8+p3Z6n4yu0wT
TLSH
T13403BE72E469DD339CF6C644B24677837FB811A399C10E94E9D96B4E004A19E270FC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8cff433c98fd5df15b70f6273ca599f2648aa696d07c0ba826ec5c2ad3dd2bd8
MD5 4cf9fd2926e13530194e44570e2c63aa
SHA1 1ad2189c1d82c03cf515d4f8dcfaa9ed19ec5f66
SHA512 1b5f6c4dbf8f61087cfe5486b1bdb34da9fd3375c42df32705a09a19fb13b49c97ebe681d1a669afcfd9c7f0581bb3f4c925f10af70e921aeb5c8065371f2d70
SSDEEP 768:aF1j+9g3fwgh12Xmhp8+p3bd66j+4BRv86aLIW8b:/9g3J8+p3Z6n4yub
TLSH
T1830307F298D78937D8AD8787A33D2E429EBCC16375845894F7C85E0DCC861BFD60A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_1190781991\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/940-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1520-388-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1700-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1700-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2304-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2364-250-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3084-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3344-285-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3420-222-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4124-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4384-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4384-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4600-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4632-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5036-375-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5048-304-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5216-363-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5644-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download